GDPR — information on data processing

1. Information notice

In accordance with Article 13 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data (GDPR), we inform you that:

• the controller of your data is MIMIR Sp. z o.o., ul. Frezerów 3, 20-209 Lublin, Poland, KRS 0000700328, VAT ID PL9462674269;
• contact for data protection matters: [email protected], telephone +48 690 328 877;
• the data comes from the contact form — you provide it yourself when sending an enquiry;
• purposes and legal bases: answering the enquiry and taking steps prior to entering into a contract (Article 6(1)(b) GDPR), and protecting the site against abuse and defending potential claims (Article 6(1)(f) GDPR);
• the recipients are solely the providers of the site’s infrastructure; the full list is in the Privacy Policy;
• retention: the enquiry log — 4 weeks; business correspondence — until the matter is closed and the limitation period for claims has expired;
• providing data is voluntary, but necessary for us to reply;
• the data is not used for automated decision-making or profiling.

2. Your rights

In connection with the processing of your data you have the following rights:

• Right of access (Article 15 GDPR) — you can find out whether we process your data, what data it is and where we got it, and receive a copy.
• Right to rectification (Article 16 GDPR) — you can ask us to correct inaccurate data and complete incomplete data.
• Right to erasure (Article 17 GDPR) — you can ask us to delete data that is no longer needed for the purpose it was collected for, or where you have effectively objected to the processing.
• Right to restriction (Article 18 GDPR) — you can ask us to suspend processing while a matter is clarified, for instance when you contest the accuracy of the data.
• Right to portability (Article 20 GDPR) — the data you provided can be sent to you in a machine-readable format.
• Right to object (Article 21 GDPR) — you can object to processing based on the controller’s legitimate interest.
• Right to withdraw consent (Article 7(3) GDPR) — where processing is based on consent, you can withdraw it at any time; this does not affect the lawfulness of processing carried out beforehand.

3. How to exercise a right

Send a request to [email protected] or in writing to the controller’s registered office. There is no mandatory form.

So that a request can be handled, please state:

• what it concerns — which of the rights listed above,
• the details that let us find the matter: the e-mail address used in the form and the approximate date the enquiry was sent.

We reply without undue delay and no later than within one month of receiving the request. For complex matters the deadline may be extended by a further two months — we will tell you within the first month and give the reason (Article 12(3) GDPR).

Exercising these rights is free of charge. A fee or a refusal to act is possible only for requests that are manifestly unfounded or excessive (Article 12(5) GDPR).

4. Complaint to the supervisory authority

If you believe we process your data unlawfully, you may lodge a complaint with the supervisory authority:

President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych) ul. Stawki 2, 00-193 Warsaw, Poland

This right applies whether or not you contact the controller first.

5. Data protection officer

The controller has not appointed a data protection officer. None of the conditions for mandatory appointment set out in Article 37(1) GDPR applies: the controller is not a public authority, its core activity does not consist of monitoring individuals on a large scale, nor of large-scale processing of special categories of data.

All personal data matters are handled directly by the controller, at [email protected].

6. Transfers outside the EEA

Traffic to the site passes through the infrastructure of a security and acceleration provider (Cloudflare, Inc.), which means data is transferred outside the European Economic Area. The basis for such transfers is described in the Privacy Policy.